You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@directory.apache.org by Marc Boorshtein <mb...@gmail.com> on 2015/03/12 21:48:16 UTC
Where can I get the client certificate?
I'm using ApacheDS as the LDAP front end for MyVD. Its been working great
for months. Here's my question, where can I get a client certificate from?
(in instances where ssl client authentication is being used for SSL
connections).
Thanks
Marc
Re: Where can I get the client certificate?
Posted by Kiran Ayyagari <ka...@apache.org>.
On Fri, Mar 13, 2015 at 8:40 PM, Marc Boorshtein <mb...@gmail.com>
wrote:
>
>>>>> Well thats untrue. The certificate can be used for user mapping,
>>>>> authorization, etc. This is VERY common in the HTTP world. In a servlet
>>>>> you can get the certificate, DN, etc from the request object.
>>>>>
>>>>> not the case in LDAP, AFAIK
>>>>
>>>
>>> OK well if it wasn't the case I wouldn't have folks asking for it :-)
>>>
>> never heard of such requirement before, curious about the usecase though
>>
>>>
>>>
> Don't have 100% of the use case either. Someone's looking for MyVD to
> give them the client certificate in an insert (our equivalent of an
> interceptor) so they can do authorizations. For service accounts its very
> elegant if you think about it as it eliminates the need for passwords
> (assuming thats what its for).
>
sounds quite heavy, cause the CRL needs to be maintained/verified on the
LDAP server
thanks for sharing.
--
Kiran Ayyagari
http://keydap.com
Re: Where can I get the client certificate?
Posted by Marc Boorshtein <mb...@gmail.com>.
>
>
>>>> Well thats untrue. The certificate can be used for user mapping,
>>>> authorization, etc. This is VERY common in the HTTP world. In a servlet
>>>> you can get the certificate, DN, etc from the request object.
>>>>
>>>> not the case in LDAP, AFAIK
>>>
>>
>> OK well if it wasn't the case I wouldn't have folks asking for it :-)
>>
> never heard of such requirement before, curious about the usecase though
>
>>
>>
Don't have 100% of the use case either. Someone's looking for MyVD to give
them the client certificate in an insert (our equivalent of an interceptor)
so they can do authorizations. For service accounts its very elegant if
you think about it as it eliminates the need for passwords (assuming thats
what its for).
Re: Where can I get the client certificate?
Posted by Kiran Ayyagari <ka...@apache.org>.
On Fri, Mar 13, 2015 at 8:28 PM, Marc Boorshtein <mb...@gmail.com>
wrote:
>
>
>
>>> Well thats untrue. The certificate can be used for user mapping,
>>> authorization, etc. This is VERY common in the HTTP world. In a servlet
>>> you can get the certificate, DN, etc from the request object.
>>>
>>> not the case in LDAP, AFAIK
>>
>
> OK well if it wasn't the case I wouldn't have folks asking for it :-)
>
never heard of such requirement before, curious about the usecase though
>
>
>> That being said, I have extended the server (
>>> http://sourceforge.net/p/myvd/code/HEAD/tree/trunk/MyVD/src/main/java/org/apache/directory/server/ldap/LdapServer.java)
>>> mainly so I can do custom SSL implementations so I can easily create a
>>> custom trust manager. The question becomes how can I associate the cert I
>>> get from the trust manager to an LDAP session? Neither the trust manager
>>> nor the keystore actually has that context.
>>>
>>> likewise you need to extend the LdapSession class as well and inject the
>> cert after authentication,
>> but to get the actual certificate to inject you need support from MINA.
>>
>> Modifying the SslFilter should be the right place to pin certificate as a
>> property in IoSession instance
>>
>
> Thats a great starting point. Thanks
>
>
--
Kiran Ayyagari
http://keydap.com
Re: Where can I get the client certificate?
Posted by Marc Boorshtein <mb...@gmail.com>.
>> Well thats untrue. The certificate can be used for user mapping,
>> authorization, etc. This is VERY common in the HTTP world. In a servlet
>> you can get the certificate, DN, etc from the request object.
>>
>> not the case in LDAP, AFAIK
>
OK well if it wasn't the case I wouldn't have folks asking for it :-)
> That being said, I have extended the server (
>> http://sourceforge.net/p/myvd/code/HEAD/tree/trunk/MyVD/src/main/java/org/apache/directory/server/ldap/LdapServer.java)
>> mainly so I can do custom SSL implementations so I can easily create a
>> custom trust manager. The question becomes how can I associate the cert I
>> get from the trust manager to an LDAP session? Neither the trust manager
>> nor the keystore actually has that context.
>>
>> likewise you need to extend the LdapSession class as well and inject the
> cert after authentication,
> but to get the actual certificate to inject you need support from MINA.
>
> Modifying the SslFilter should be the right place to pin certificate as a
> property in IoSession instance
>
Thats a great starting point. Thanks
Re: Where can I get the client certificate?
Posted by Kiran Ayyagari <ka...@apache.org>.
On Fri, Mar 13, 2015 at 7:55 PM, Marc Boorshtein <mb...@gmail.com>
wrote:
>
>> here you have access to the certificate and this is the only place where
>> you have a chance to see it,
>> and if you want to store it for any other purpose then you need to extend
>> server, cause certs are useless
>> after establishing a secure channel.
>>
>>>
>>>
> Well thats untrue. The certificate can be used for user mapping,
> authorization, etc. This is VERY common in the HTTP world. In a servlet
> you can get the certificate, DN, etc from the request object.
>
> not the case in LDAP, AFAIK
> That being said, I have extended the server (
> http://sourceforge.net/p/myvd/code/HEAD/tree/trunk/MyVD/src/main/java/org/apache/directory/server/ldap/LdapServer.java)
> mainly so I can do custom SSL implementations so I can easily create a
> custom trust manager. The question becomes how can I associate the cert I
> get from the trust manager to an LDAP session? Neither the trust manager
> nor the keystore actually has that context.
>
> likewise you need to extend the LdapSession class as well and inject the
cert after authentication,
but to get the actual certificate to inject you need support from MINA.
Modifying the SslFilter should be the right place to pin certificate as a
property in IoSession instance
> Thanks
> Marc
>
--
Kiran Ayyagari
http://keydap.com
Re: Where can I get the client certificate?
Posted by Marc Boorshtein <mb...@gmail.com>.
Also, I've already got a custom implementation of DefaultCoreSession, can I
get the certificate from the IoSession? Or should I be asking that
question to the MINA list?
Thanks
On Fri, Mar 13, 2015 at 7:55 AM, Marc Boorshtein <mb...@gmail.com>
wrote:
>
>> here you have access to the certificate and this is the only place where
>> you have a chance to see it,
>> and if you want to store it for any other purpose then you need to extend
>> server, cause certs are useless
>> after establishing a secure channel.
>>
>>>
>>>
> Well thats untrue. The certificate can be used for user mapping,
> authorization, etc. This is VERY common in the HTTP world. In a servlet
> you can get the certificate, DN, etc from the request object.
>
> That being said, I have extended the server (
> http://sourceforge.net/p/myvd/code/HEAD/tree/trunk/MyVD/src/main/java/org/apache/directory/server/ldap/LdapServer.java)
> mainly so I can do custom SSL implementations so I can easily create a
> custom trust manager. The question becomes how can I associate the cert I
> get from the trust manager to an LDAP session? Neither the trust manager
> nor the keystore actually has that context.
>
> Thanks
> Marc
>
Re: Where can I get the client certificate?
Posted by Marc Boorshtein <mb...@gmail.com>.
>
>
> here you have access to the certificate and this is the only place where
> you have a chance to see it,
> and if you want to store it for any other purpose then you need to extend
> server, cause certs are useless
> after establishing a secure channel.
>
>>
>>
Well thats untrue. The certificate can be used for user mapping,
authorization, etc. This is VERY common in the HTTP world. In a servlet
you can get the certificate, DN, etc from the request object.
That being said, I have extended the server (
http://sourceforge.net/p/myvd/code/HEAD/tree/trunk/MyVD/src/main/java/org/apache/directory/server/ldap/LdapServer.java)
mainly so I can do custom SSL implementations so I can easily create a
custom trust manager. The question becomes how can I associate the cert I
get from the trust manager to an LDAP session? Neither the trust manager
nor the keystore actually has that context.
Thanks
Marc
Re: Where can I get the client certificate?
Posted by Kiran Ayyagari <ka...@apache.org>.
On Fri, Mar 13, 2015 at 7:38 PM, Marc Boorshtein <mb...@gmail.com>
wrote:
> That will validate the certificate. But I need to be able to get the
> certificate from inside of an interceptor. Is there any way I can get it
> from the LdapSession?
>
here you have access to the certificate and this is the only place where
you have a chance to see it,
and if you want to store it for any other purpose then you need to extend
server, cause certs are useless
after establishing a secure channel.
> On Mar 13, 2015 3:58 AM, "Kiran Ayyagari" <ka...@apache.org> wrote:
>
>>
>>
>> On Fri, Mar 13, 2015 at 1:09 PM, Marc Boorshtein <mb...@gmail.com>
>> wrote:
>>
>>> Correct.
>>> On Mar 12, 2015 8:24 PM, "Kiran Ayyagari" <ka...@apache.org> wrote:
>>>
>>>>
>>>>
>>>> On Fri, Mar 13, 2015 at 4:48 AM, Marc Boorshtein <mboorshtein@gmail.com
>>>> > wrote:
>>>>
>>>>> I'm using ApacheDS as the LDAP front end for MyVD. Its been working
>>>>> great for months. Here's my question, where can I get a client certificate
>>>>> from? (in instances where ssl client authentication is being used for SSL
>>>>> connections).
>>>>>
>>>>> so to be clear you are trying to verify the certificate of the client
>>>> that is connecting to ApacheDS, correct?
>>>>
>>> currently this is not supported by the server, it just accepts all
>> certificates of all clients.
>>
>> This can be supported easily by allowing admins to configure either
>> 1. a custom TrustManager or
>> 2. a truststore file.
>> 3. or both
>> I personally prefer 1 cause that will allow for a custom cert verifier
>> and can avoid the overhead of loading client certs into a file
>>
>> Can you raise a feature request in JIRA?
>>
>>> Thanks
>>>>> Marc
>>>>>
>>>>
>>>>
>>>>
>>>> --
>>>> Kiran Ayyagari
>>>> http://keydap.com
>>>>
>>>
>>
>>
>> --
>> Kiran Ayyagari
>> http://keydap.com
>>
>
--
Kiran Ayyagari
http://keydap.com
Re: Where can I get the client certificate?
Posted by Marc Boorshtein <mb...@gmail.com>.
That will validate the certificate. But I need to be able to get the
certificate from inside of an interceptor. Is there any way I can get it
from the LdapSession?
On Mar 13, 2015 3:58 AM, "Kiran Ayyagari" <ka...@apache.org> wrote:
>
>
> On Fri, Mar 13, 2015 at 1:09 PM, Marc Boorshtein <mb...@gmail.com>
> wrote:
>
>> Correct.
>> On Mar 12, 2015 8:24 PM, "Kiran Ayyagari" <ka...@apache.org> wrote:
>>
>>>
>>>
>>> On Fri, Mar 13, 2015 at 4:48 AM, Marc Boorshtein <mb...@gmail.com>
>>> wrote:
>>>
>>>> I'm using ApacheDS as the LDAP front end for MyVD. Its been working
>>>> great for months. Here's my question, where can I get a client certificate
>>>> from? (in instances where ssl client authentication is being used for SSL
>>>> connections).
>>>>
>>>> so to be clear you are trying to verify the certificate of the client
>>> that is connecting to ApacheDS, correct?
>>>
>> currently this is not supported by the server, it just accepts all
> certificates of all clients.
>
> This can be supported easily by allowing admins to configure either
> 1. a custom TrustManager or
> 2. a truststore file.
> 3. or both
> I personally prefer 1 cause that will allow for a custom cert verifier and
> can avoid the overhead of loading client certs into a file
>
> Can you raise a feature request in JIRA?
>
>> Thanks
>>>> Marc
>>>>
>>>
>>>
>>>
>>> --
>>> Kiran Ayyagari
>>> http://keydap.com
>>>
>>
>
>
> --
> Kiran Ayyagari
> http://keydap.com
>
Re: Where can I get the client certificate?
Posted by Kiran Ayyagari <ka...@apache.org>.
On Fri, Mar 13, 2015 at 1:09 PM, Marc Boorshtein <mb...@gmail.com>
wrote:
> Correct.
> On Mar 12, 2015 8:24 PM, "Kiran Ayyagari" <ka...@apache.org> wrote:
>
>>
>>
>> On Fri, Mar 13, 2015 at 4:48 AM, Marc Boorshtein <mb...@gmail.com>
>> wrote:
>>
>>> I'm using ApacheDS as the LDAP front end for MyVD. Its been working
>>> great for months. Here's my question, where can I get a client certificate
>>> from? (in instances where ssl client authentication is being used for SSL
>>> connections).
>>>
>>> so to be clear you are trying to verify the certificate of the client
>> that is connecting to ApacheDS, correct?
>>
> currently this is not supported by the server, it just accepts all
certificates of all clients.
This can be supported easily by allowing admins to configure either
1. a custom TrustManager or
2. a truststore file.
3. or both
I personally prefer 1 cause that will allow for a custom cert verifier and
can avoid the overhead of loading client certs into a file
Can you raise a feature request in JIRA?
> Thanks
>>> Marc
>>>
>>
>>
>>
>> --
>> Kiran Ayyagari
>> http://keydap.com
>>
>
--
Kiran Ayyagari
http://keydap.com
Re: Where can I get the client certificate?
Posted by Marc Boorshtein <mb...@gmail.com>.
Correct.
On Mar 12, 2015 8:24 PM, "Kiran Ayyagari" <ka...@apache.org> wrote:
>
>
> On Fri, Mar 13, 2015 at 4:48 AM, Marc Boorshtein <mb...@gmail.com>
> wrote:
>
>> I'm using ApacheDS as the LDAP front end for MyVD. Its been working
>> great for months. Here's my question, where can I get a client certificate
>> from? (in instances where ssl client authentication is being used for SSL
>> connections).
>>
>> so to be clear you are trying to verify the certificate of the client
> that is connecting to ApacheDS, correct?
>
>> Thanks
>> Marc
>>
>
>
>
> --
> Kiran Ayyagari
> http://keydap.com
>
Re: Where can I get the client certificate?
Posted by Kiran Ayyagari <ka...@apache.org>.
On Fri, Mar 13, 2015 at 4:48 AM, Marc Boorshtein <mb...@gmail.com>
wrote:
> I'm using ApacheDS as the LDAP front end for MyVD. Its been working great
> for months. Here's my question, where can I get a client certificate from?
> (in instances where ssl client authentication is being used for SSL
> connections).
>
> so to be clear you are trying to verify the certificate of the client that
is connecting to ApacheDS, correct?
> Thanks
> Marc
>
--
Kiran Ayyagari
http://keydap.com